# Domains and OAuth

MMI owns the central project registry and provisioning workflows. Read
`mmi-cli oracle org project get <owner/repo> --json` before changing hostnames or login settings.
Use the declared edge domains for each stage; do not guess hostnames from a slug or create a
second DNS/deployment control plane in a product repository. New project setup goes through
[bootstrap](../../bootstrap/SKILL.md).

Cloudflare owns public DNS and edge TLS. Preserve unrelated records during an authorized change.
A dev stage is private only after its independent edge-block check succeeds. A configured record
or successful deployment alone does not prove access control. Use [stage](../../stage/SKILL.md)
for the supported private live workflow.

## Google OAuth

An eligible project uses one Google web client across local, dev, rc, and main, not one per stage.
The registry declares OAuth metadata and extra callback paths for additional login/connect flows.
Generate the current origins and redirects with
`mmi-cli vault org oauth plan --repo <owner/repo> --json`; do not assemble a copied URI list.
The plan includes the declared edge hosts, callback paths, and supported loopback redirects.

Client creation and editing are human Google Console actions. Add the planned origins and redirects
to that client. Store its downloaded credentials through
`mmi-cli vault org oauth set-creds --repo <owner/repo>` using the file on stdin, never its contents
in chat or command arguments. Keep credential files outside the repository and remove the temporary
download after the authorized import. The stored pair is shared across stages through the vault.

Run `mmi-cli vault org oauth verify --repo <owner/repo>` before removing a working redirect.
Verification probes redirect acceptance; it does **not** inspect registered JavaScript origins.
Reconcile those against the plan in Console. Check actual authority and use the
[vault guide](vault.md) for the credential boundary.